Hacker News Reader

When scanning the stack, you interpret every word as a potential pointer. Then, you ask your GCs allocator "is this pointer's address in one of your pages?". If it isn't, you're done. If it is, then you check if it's the pointer to the start of an object (there's a bitmap of "is object start" for each word on the page). If this passes too, then you effectively reinterpret cast it to a "GC object" base class which is shared for all GC objects, and call the virtual "trace" function from there.

Maybe a stupid question, but how would this detect random data byte sequences that accidentally form a valid GC object pointer?

It doesn't. That is what it means for GC to be conservative.

All GC objects have GC headers prepended, from which you can lookup the class and how to scan it.

https://github.com/v8/v8/blob/master/src/heap/cppgc/heap-obj...

Here is the related research paper https://duckduckgo.com/?q=Cross-Component+Garbage+Collection